JP5301675B2 - Method and apparatus for performing RAID processing - Google Patents

Description

  The present disclosure relates to RAID (Redundant Array of Independent Disks), and more particularly to level 6 RAID.

  RAID combines multiple physical hard disk drives into logical drives for reliability, capacity or performance. Thus, instead of multiple physical hard disk drives, the operating system refers to a single logical drive. As is well known to those skilled in the art, there are a number of standard methods called RAID levels for distributing data across the physical hard disk drives of a RAID system.

  For example, in a level 0 RAID system, data is striped into a physical hard disk drive array by dividing the data into blocks and writing each block to a separate hard disk drive. Input / output (I / O) performance is improved by distributing the load across multiple hard disk drives. Level 0 RAID improves I / O performance but does not provide redundancy because if one hard disk drive fails, all data is lost.

  Level 5 RAID systems provide a high level of redundancy by striping both data and parity information to at least three hard disk drives. Data striping is combined with distributed parity to provide a recovery path in case of failure.

  Level 6 RAID (RAID-6) provides a higher level of redundancy than a Level 5 RAID system by allowing recovery from the failure of two disks. In the level 6 RAID system, two syndromes called P syndrome and Q syndrome are generated for data and stored in the hard disk drive of the RAID system.

P syndrome is generated by calculating parity information of data in a stripe (data block (strip), P syndrome block, and Q syndrome block). The generation of Q syndrome requires Galois Field multiplication and is complicated in the event of a disk drive failure. The Galois field (finite field) calculation GF (2 ⁸ ) is defined via the reduction polynomial x ⁸ + x ⁴ + x ³ + x + 1 (ie, 11B (in hexadecimal)).

  The regeneration scheme for recovering data, P syndrome and / or Q syndrome executed during the disk recovery process requires both Galois field multiplication and inverse operation.

  For example, n data disks D0, D1, D2,. . . , Dn−1 (n ≦ 255), two quantities are required to recover from the loss of two disks, two quantities: parity (P) and Reed-Solomon code (Q). .

  P and Q are

により定義される。ここで、ｇ＝｛０２｝は、ガロア体（有限体）ＧＦ（２^８）の要素であり、“＋”及び“・”はこの体における演算である。

Defined by Here, g = {02} is an element of a Galois field (finite field) GF (2 ⁸ ), and “+” and “•” are operations in this field.

The computational bottleneck for RAID-6 systems is the cost of calculating Q. This difficulty stems from the fact that conventional processors (CPU (Central Processing Unit)) have poor performance for computations in Galois field (finite field) GF (2 ⁸ ). Therefore, table lookup based algorithms are typically used to improve performance. The use of table lookup results in an inherently slow serial process.

The features of each embodiment of the claimed subject matter will become apparent by reference to the following detailed description, taken in conjunction with the drawings, in which like numerals indicate like parts.
FIG. 1 is a block diagram illustrating an example of a RAID-6 array showing a plurality of stripes having data blocks (strips), each having a P syndrome and a Q syndrome, with each stripe striped into a hard disk array. FIG. 2 is a block diagram of a system having instructions for performing AES encryption and decryption in a general purpose processor. FIG. 3 is a block diagram of an embodiment of the processor shown in FIG. FIG. 4 is a flowchart of an embodiment of a method for performing Galois field multiplication according to the principles of the present invention. FIG. 5A illustrates the use of a packed shuffle byte (PSHUFB) instruction. FIG. 5B illustrates the use of a packed shuffle byte (PSHUFB) instruction. FIG. 5C illustrates the use of a packed shuffle byte (PSHUFB) instruction. FIG. 6A is sample code that allows Galois field multiplication to be performed simultaneously on multiple 16-byte data blocks. FIG. 6B is sample code that allows Galois field multiplication to be performed simultaneously on multiple 16-byte data blocks. FIG. 6C is sample code that allows Galois field multiplication to be performed simultaneously on multiple 16-byte data blocks. The following detailed description proceeds with reference to exemplary embodiments of the claimed subject matter, but numerous alternatives, modifications, and variations will be apparent to those skilled in the art. Accordingly, the claimed subject matter is to be regarded broadly and is defined only by the terms given in the appended claims.

  FIG. 1 is a block diagram illustrating an embodiment of a RAID-6 array 100 showing a plurality of stripes including data blocks (strips), each of which is striped across an array of hard disks 150, P syndrome, and Q syndrome. In the illustrated embodiment, the RAID array 100 has five hard disks 150. Data is written to the RAID-6 array using block level striping with P and Q syndromes distributed across the member hard disks in a round robin fashion. Sequential data, such as files segmented into blocks, may be distributed across stripes such as horizontal stripe 0 having one of the blocks stored in the three data blocks 102, 104, 106 of the data disk 150. In one embodiment, there are 512 bytes in each block of the stripe.

  The P and Q syndromes calculated for the data blocks 102, 104, and 106 of the horizontal stripe 0 are stored in the P block 130 and the Q block 132 of the stripe 0, respectively. P and Q syndrome blocks are stored on different hard disks 150 in each stripe.

  The P syndrome may be generated by performing an exclusive OR (XOR) operation. XOR is a logical operation on two operands that yields a logical value “1” only if only one of the operands has a logical value of “1”. For example, an XOR of a first operand having a value of “11001010” and a second operand having a value of “10000011” provides a result having a value of “01001001”. If the hard disk storing the first operand fails, the first operand may be recovered by performing an XOR operation on the second operand and the result.

  P syndrome is

の（ＸＯＲ）演算を用いてストライプ全体に対して計算されるデータ（Ｄ）のシンプルなパリティである。ｎ個のデータディスクを有するシステムでは、Ｐシンドロームの生成は、以下の式１により表される。

This is a simple parity of data (D) calculated for the entire stripe using the (XOR) operation of. In a system having n data disks, the generation of P syndrome is expressed by the following Equation 1.

Ｑシンドロームの計算は、ガロア体多項式（ｇ）を用いた乗算（・）を要求する。極めて高いパフォーマンスにより８ビット（バイト）ガロア体多項式に対して、算出演算が実行される。多項式は、有限個の定数と変数とが加算、減算、乗算及び非負の整数の指数のみを用いて結合された式である。１つの原始多項式は、ｘ^８＋ｘ^４＋ｘ^３＋ｘ＋１である。多項式に対するガロア体（ＧＦ）演算はまた、ＧＦ（２^８）計算とも呼ばれる。ｎ個のデータディスクを有するシステムでは、Ｑシンドロームの生成は、以下の式２により表される。

The calculation of the Q syndrome requires multiplication (•) using a Galois field polynomial (g). Calculation operations are performed on 8-bit (byte) Galois field polynomials with extremely high performance. A polynomial is an expression in which a finite number of constants and variables are combined using only addition, subtraction, multiplication, and non-negative integer exponents. One primitive polynomial is x ⁸ + x ⁴ + x ³ + x + 1. Galois field (GF) operations on polynomials are also referred to as GF (2 ⁸ ) calculations. In a system having n data disks, the generation of the Q syndrome is expressed by the following Equation 2.

バイト単位のガロア体演算は、ブロックの各バイトがその他のバイトから計算上独立しているストライプベースにより実行される。バイト単位のガロア体演算は、２５５（２^８−１）個のデータディスクまで収容可能である。

Byte-wise Galois field operations are performed on a stripe base where each byte of the block is computationally independent from the other bytes. A byte unit Galois field operation can accommodate up to 255 (2 ⁸ -1) data disks.

  The performance of Q syndrome generation may be improved by representing Q by its Horner representation, as represented by Equation 3 below.

従って、２つの演算がＱを計算するのに用いられる。

Accordingly, two operations are used to calculate Q.

式２に示される計算とは対照的に、式３の計算はＧＦ２５６の一般的な乗算を必要としない。その代わりに、乗算はｇ｛０２｝によるものである。１バイトについて、ｇ＝｛０２｝との乗算は、値を左に１ビットだけシフトすることによって実行可能である。その後、条件付の排他的ＯＲ（ＸＯＲ）演算が、乗算の結果と、当該結果の最上位ビットの状態に基づく他の値とに対して実行される。一時に４バイトをパラレルに計算するため、｛０２｝による乗算は、４バイトに格納されている値を左に１ビットだけシフトし、後述されるようにバイト毎に４つの条件付ＸＯＲ演算を実行することによって実行される。

In contrast to the calculation shown in Equation 2, the calculation in Equation 3 does not require a general multiplication of GF256. Instead, multiplication is by g {02}. For one byte, multiplication with g = {02} can be performed by shifting the value to the left by one bit. A conditional exclusive OR (XOR) operation is then performed on the result of the multiplication and other values based on the state of the most significant bit of the result. In order to calculate 4 bytes in parallel at a time, multiplication by {02} shifts the value stored in 4 bytes by 1 bit to the left, and performs four conditional XOR operations for each byte as described below. It is executed by executing.

“＆０ｘｆｅｆｅｆｅｆｅ”は、所望されないキャリを回避するためのマスクである。しかしながら、条件付ＸＯＲ演算はあまり効率的でない。その計算時間は、４バイトの代わりに８バイトをパラレルに処理し、８バイトのそれぞれにおける最上位ビット（ＭＳＢ）に基づくマスクを用いることによって、低減されてもよい。

“& 0xfefefe” is a mask for avoiding an unwanted carry. However, conditional XOR operations are not very efficient. The computation time may be reduced by processing 8 bytes in parallel instead of 4 bytes and using a mask based on the most significant bit (MSB) in each of the 8 bytes.

The calculation of the RAID-6 Q syndrome is used by Advanced Institute of Standards (NIST) Advanced GF ⁸ published by National Institute of Standards (NIST) as Federal Information Processing Standard (FIPS) 197. Use the same expression. AES is symmetric block encryption that can encrypt and decrypt information.

In one embodiment, an AES instruction using GF (2 ⁸ ) is used to perform a Galois field multiplication operation to calculate the Q syndrome required for RAID level 6 in accordance with the principles of the present invention.

  FIG. 2 is a block diagram of a system 200 that includes instructions for performing AES encryption and decryption in a general purpose processor. The system 200 includes a processor 201, an MCH (Memory Controller Hub) or a GMCH (Graphics Memory Controller Hub) 202, and an input / output (I / O) controller hub (ICH) 204. The MCH 202 includes a memory controller 206 that controls communication between the processor 201 and the memory 208. The processor 201 and the MCH 202 communicate via the system bus 216.

  The processor 201 is a single-core Intel (registered trademark) Pentium (registered trademark) IV processor, single-core Intel Celeron processor, Intel (registered trademark) XScale processor, Intel (registered trademark) Pentium (registered trademark) D, Intel (registered trademark). It may be either a multi-core processor such as a Xeon (R) processor, an Intel (R) Core (R) Duo processor, or any other type of processor.

  Memory 208 includes DRAM (Dynamic Random Access Memory), SRAM (Static Random Access Memory), SDRAM (Synchronized Dynamic Random Access Memory), and DDR2 (Dum2 Random Access Memory). This type of memory may be used.

  The ICH 204 may be connected to the MCH 202 using a high-speed chip-to-chip interconnect 214 such as DMI (Direct Media Interface). DMI supports a 2 Gigabit / second simultaneous transmission rate over two unidirectional lanes.

  The ICH 204 may include a storage I / O controller 210 for controlling communication with at least one storage device 212 such as RAID 100 (FIG. 1). The ICH 204 may use a serial storage protocol such as Serial Attached Small Computer System Interface (SAS) or Serial Advanced Technology Attachment (SATA) to communicate with the storage protocol interconnect 218.

  The processor 201 has an AES function 203 that executes AES encryption and decryption processing. The AES function 203 is used to encrypt or decrypt information stored in the memory 208 and / or the storage device 212.

  Encryption performs a series of conversion processes for converting understandable data called “plaintext” into an incomprehensible format called “ciphertext” using a secret key (encryption key). In the conversion process in encryption, (1) a round key (value derived from the encryption key) is added to a state (two-dimensional byte array) using an exclusive OR (XOR) operation, and (2) a nonlinear byte replacement table. Process the state using (S-Box), (3) cyclically shift the last three columns of the state by different offsets, (4) extract all the columns of the state, referred to as mix column transformation Combining these data (independent of each other) to generate a new column. These four conversion processes are executed by a single AES instruction described later.

In mixed column transformations, data from all the columns in the state are combined (independent of each other) to generate a new column. The mix column is a 128 bit → 128 bit conversion performed on a 4 × 4 matrix representation column with 128 bits (16 bytes) input. This transformation treats each column as a third-order polynomial having coefficients of AES-Galois field 256. Each column of the 4 × 4 matrix representation of the state is multiplied by the polynomial a (x) = {03} x ³ + {01} x ² + {01} x + {02} and is reduced modulo x ⁴ +1. . The mixed column conversion from 128 bits to 128 bits is a conversion from 16 bytes to 16 bytes. For example, 16 bytes (state) may be indicated as [p, o, n, m, i, k, j, i, h, g, f, e, d, c, b, a], where Where a is the least significant byte, the state has four columns, and each column is a 32-bit doubleword (4 bytes).

The mix column transformation is a matrix multiplication based on the GF (2 ⁸ ) calculation (modulo x ⁸ + x ⁴ + x ³ + x + 1). Accordingly, the mix column transform may be utilized by the Galois field multiplication function 250 to calculate the Q syndrome for the level 6 RAID system as described below. In order to take advantage of mix column multiplication, the mix column transformation is isolated from the AES instruction.

  Mix column transformations are performed individually on the four columns of states. The four columns are (1) [p, o, n, m], (2) [i, k, j, i], (3) [h, g, f, e] and (4) [d, c, b, a].

  As shown in Table 1, the result of the mix column conversion for [p, o, n, m, i, k, j, i, h, g, f, e, d, c, b, a] p ′, o ′, n ′, m ′, i ′, k ′, j ′, i ′, h ′, g ′, f ′, e ′, d ′, c ′, b ′, a ′]. .

テーブル１に示されるように、４つの列のそれぞれに対して同一の処理が実行される。

As shown in Table 1, the same processing is executed for each of the four columns.

  Thus, assuming that these processes are similar for each doubleword (column), a simple notation may be used to describe the mix column transformation for one of the four columns (eg, Column 4 which is the lower double word).

  For column 4, doubleword (dword) = [d, c, b, a], and the mixed column conversion by simple notation is expressed as shown below.

図３は、図２に示されるプロセッサ２０１の実施例のブロック図である。プロセッサ２０１は、レベル１（Ｌ１）命令キャッス３０２から受け取ったプロセッサ命令を復号化するためのフェッチ復号化ユニット３０６を有する。プロセッサ命令を実行するため用いられるデータは、レジスタファイル３０８に格納されてもよい。一実施例では、レジスタファイル３０８は、ＡＥＳ命令により使用されるデータを格納するため、ＡＥＳ命令により用いられる複数の１２８ビットレジスタを有する。

FIG. 3 is a block diagram of an embodiment of the processor 201 shown in FIG. The processor 201 includes a fetch decoding unit 306 for decoding processor instructions received from the level 1 (L1) instruction cache 302. Data used to execute processor instructions may be stored in register file 308. In one embodiment, register file 308 includes a plurality of 128-bit registers used by AES instructions to store data used by AES instructions.

  In one embodiment, register file 308 is a 128-bit MMX register similar to the Intel Pentium® MMX processor with Streaming (Single Instruction Multiple Data (SIMD)) Extension (SSE) instruction set. A group of registers. In a SIMD processor, data is processed in 128-bit blocks by loading one 128-bit block at a time.

  The fetch decoding unit 306 fetches a macro instruction from the L1 instruction cache 302, decodes the macro instruction, and divides it into simple processing called micro processing (μops) stored in a microcode ROM (Read Only Memory) 314. . A pipelined execution unit 310 schedules and executes microprocessing. In the illustrated embodiment, the AES function 203 of the execution unit 310 includes microinstructions for AES instructions. If there is data ready for processing, the AES instruction is fully pipelined so that the processor (CPU) may send the instruction in every cycle. The retirement unit 312 writes the result of the executed AES instruction to a register or memory. The round key 316 used by the AES instruction may be stored in the L1 data cache 304 and loaded into the execution unit 310 for use by microprocessing to execute any of the AES instructions.

  After the AES instruction is decoded by the fetch decoding unit 306, execution of the AES instruction by the execution unit 310 involves executing micro processing related to the AES instruction stored in the microcode ROM 314.

  The AES instruction set has separate AES instructions for performing an encryption round, a decryption round, an encryption final round, and a decryption final round. In one embodiment, each AES instruction has a unique processing code (opcode).

  As shown in Table 2, the AES instruction set has four AES instructions (encrypt, decrypt, encrypt last round, and decrypt last round). The AES instruction of the AES instruction set includes a single round process to perform the encryption and decryption round processes used for all rounds except the final round.

例えば、テーブル２のＡＥＳＥＮＣシングルラウンド命令では、入力データは１２８ビットレジスタ（ｘｍｍｓｒｃｄｓｔ）に格納され、ラウンドキーは他の１２８ビットレジスタ（ｘｍｍ）に格納される。この命令は、１２８ビットｘｍｍｓｒｃｄｓｔレジスタに格納される入力データ（ソース）に対して１つのＡＥＳ暗号化ラウンドの一連の４つの変換処理を実行し、ラウンド処理の実行結果によって１２８ビットｘｍｍｓｒｃｄｓｔレジスタに格納される入力データを上書きする。このため、ｘｍｍｓｒｃｄｓｔはまず、入力データを格納し、その後にＡＥＳラウンド処理の結果を格納する。

For example, in the AESENC single round instruction in Table 2, the input data is stored in a 128-bit register (xmmsrcdst), and the round key is stored in another 128-bit register (xmm). This instruction performs a series of four conversion processes of one AES encryption round on the input data (source) stored in the 128-bit xmmsrcdst register, and is stored in the 128-bit xmmsrcdst register according to the execution result of the round process. Overwrite the input data. For this reason, xmmsrcdst first stores the input data, and then stores the result of the AES round process.

As shown in Table 2, using the terminology of FOPIS Publication 197, the corresponding sequence of 128 bit → 128 bit conversion is described. The encryption round conversion sequence includes:
(1) AddRoundKey transformation: A round key (value derived from an encryption key) is added to a state (two-dimensional 128-bit byte array) using an exclusive OR (XOR) operation. AddRoundKey is defined as a bitwise XOR of its two arguments (128 bits, 128 bits) → 128 bit conversion. In the AES flow, these arguments are state and round key.
(2) SubBytes transformation: the state is processed using a non-linear byte replacement table (S-Box). SubBytes is a conversion from 16 bytes to 16 bytes (byte unit) defined by applying S-box conversion to each of the 16 bytes of input. The S-box conversion can be expressed through a lookup table as follows. The input to the lookup table is bytes B [7: 0]. However, x and y indicate a low nibble and a high nibble, and x [3: 0] = B [7: 4] and y [3: 0] = B [3: 0]. The output byte is encoded in the table as a 2-digit number in hexadecimal (H) notation. For example, input 85H results in 97H.
(3) ShiftRows transformation: The last three rows of the state are cyclically shifted by different offsets. ShiftRows is a permutation of the following byte units.

この変換は、状態の４×４のマトリックス表現に対する処理としてみなされる。４×４のマトリックスの第１行は変更されない。第２行は、１バイトポジションだけ左回転される。第３行は、２バイトポジションだけ左回転される。第４行は、３バイトポジションだけ左回転される。
（４）ミックスカラム変換：状態のすべての列からのデータが、新たな列を生成するためミックスされる（互いに独立して）。ミックスカラムは、１２８ビット（１６バイト）入力の４×４のマトリックス表現の列に対して実行される１２８ビット→１２８ビットへの変換である。この変換は、各列をＡＥＳガロア体２５６の係数を有する３次の多項式として扱う。状態の４×４のマトリックス表現の各列は、多項式ａ（ｘ）＝｛０３｝ｘ^３＋｛０１｝ｘ^２＋｛０１｝ｘ＋｛０２｝と乗算され、ｘ^４＋１の還元モジュローされる。

This transformation is viewed as a process for a 4 × 4 matrix representation of the state. The first row of the 4x4 matrix is not changed. The second line is rotated left by one byte position. The third line is rotated left by 2 byte positions. The fourth line is rotated left by 3 byte positions.
(4) Mixed column conversion: Data from all columns in the state are mixed (independent of each other) to generate a new column. The mix column is a 128 bit → 128 bit conversion performed on a 4 × 4 matrix representation column with 128 bits (16 bytes) input. This conversion treats each column as a cubic polynomial having coefficients of AES Galois field 256. Each column of the 4 × 4 matrix representation of the state is multiplied by the polynomial a (x) = {03} x ³ + {01} x ² + {01} x + {02} and reduced modulo x ⁴ +1. .

  As shown in Table 2, the AES final encryption round instruction AESENCLAST does not perform mix column conversion.

  Decryption (reverse encryption) executes a series of conversion processes for converting “ciphertext” into “plaintext” of the same size using an encryption key. The conversion process in reverse encryption is the reverse of the conversion process in encryption.

  The decryption round conversion sequence described above is performed by a single AES decryption round instruction AESDEC, as shown in Table 2, and for the last decryption round, by a single AES final decryption round instruction AESDECCLAST. Is done.

  A combination of instructions including AES encryption and decryption instructions may be used to obtain sub-steps (transformations) of the AES algorithm as isolated transforms. Isolated transformations include Shift Rows, Substitute Bytes, and Mix columns used by encrypted AES instructions (AESENC, AESENCLAST).

  Embodiments of the present invention compute a level 6 RAID Q syndrome using an isolated AES mix column transform obtained using a combination of instructions using AES encryption and decryption instructions.

  FIG. 4 is a flowchart of an embodiment of a method for performing Galois field (GF) multiplication according to the principles of the present invention.

  Microprocessing for mix column conversion is used in both AESENC and AESDEC instructions. As shown in Table 2, the AESDEC instruction includes a conversion process opposite to the conversion process in the AESENC instruction. Therefore, the micro processing of the mixed column conversion is performed by executing an instruction sequence of (1) AESENC instruction with a round key set to zero and (2) AESDECLAST instruction with a round key set to zero. It may be isolated.

  With reference to the conversion sequence for each AES instruction, this instruction sequence isolates the mix column conversion. This is because the AddRoundKey micro process executes a No process (NOP), and the other micro process (Shift Rows, Substitute Bytes) is changed to a reverse micro process (Inverse Shift Rows, Inverse Substitute Bytes). The

  Thus, execution of the sequence of AES instructions (AESENC, AESENCLAST) isolates the mix column (state) transformation as shown below.

Y = Inverse Mix Columns (Inverse Substitute Bytes (Inverse Shift Rows (Substitute Bytes (Shift Rows)))
The isolated mix column transformation is used to multiply 16 bytes and {02} in an AES Galois field according to an embodiment of the present invention. 16 bytes (p, o, n, m, l, k, j, i, h, g, f, e, d, c, b, a) 4 (d, c, b, a) and {02} An embodiment for multiplying is described.

  In this embodiment, the finite field is defined by a reduction polynomial 0x11b. In other embodiments, the selection of body representation may be configurable.

  Referring to FIG. 4, in block 400, to provide (0, c, 0, a), the odd byte positions of the input data (d, c, b, a) are zero, ie, b = d = Set to zero. In one embodiment, a packed shuffle byte (PSHUFB) instruction is used to set the odd byte position to zero.

  5A-5C illustrate the use of a packed shuffle byte (PSHUFB) instruction. The PSHUFB instruction shuffles the bytes of the first operand based on the shuffle control mask stored in the second operand (executes in-place shuffling of bytes). If the most significant bit of the shuffle control mask byte is set, zero is written to the corresponding byte of the first operand.

The PSHUFB instruction has two 128-bit inputs called two registers, bytes A and B. PSHUFB contains bytes A = [a ₁₅ a ₁₄ a ₁₃ . . . a ₀ ] and B = [b ₁₅ b ₁₄ b ₁₃ . . . b ₀ ] and take register A as [a _b15 a _b14 a _b13 . . . a _b0 ]. If the first bit of b _i is set to 1, the resulting i-th entry is 0.

  Referring to FIG. 5A, block 500 shows the initial contents of the lower 4 bytes of the 128-bit first register, and block 502 shows the first after the PSHUFB instruction is executed with the shuffle control mask of “ff02ff00h”. Indicates the contents of the lower 4 bytes of the register. As shown in the figure, the two odd bytes (byte 1 and byte 3) are set to “0” because the MSB is set to “1”.

  Referring to FIG. 4, after the odd byte is set to “0”, the mix column conversion is performed by executing the AESDECLAST and subsequent AESENC instruction sequence using the contents of the first register. This instruction sequence is

という変換を実行する。

The conversion is executed.

  Since both d and b are zero, the result of the instruction sequence “d = 0, c, b = 0, a” is 3a + c, a + 2c, a + 3c, 2a + c.

  Next, the odd bytes of the result (3a + c, a + 2c, a + 3c, 2a + c) are set to zero using the packed shuffle byte (PSHUFB), and the result of the second PSHUFB instruction (0, a + 2c, 0, 2a + c) is the first. Stored in one register.

  At block 404, the even byte position of the input data (d, c, b, a) is set to zero, i.e., a = c = 0, to provide (d, 0, b, 0). In one embodiment, a packed shuffle byte (PSHUFB) instruction is used to set the even byte position to zero.

  Referring to FIG. 5B, reference numeral 502 indicates the initial contents of the first register, and reference numeral 504 indicates the contents of the first register after the PSHUFB instruction is executed with the shuffle control mask of “03ff01ffh”. As shown, all even byte positions are set to “0”.

  Referring to FIG. 4, after the even byte position is set to “0”, the mix column conversion is executed by executing an instruction sequence with AESDECC after AESDECLAST using the contents of the first register. This instruction sequence is

という変換を実行する。

The conversion is executed.

  Since both c and a are zero, the result of the instruction sequence “d, c = 0, b, a = 0” is b + 2d, b + 3d, 2b + d, 3b + d.

  Next, the even bytes of the result (b + 2d, b + 3d, 2b + d, 3b + d) are set to zero using the packed shuffle byte (PSHUFB), and the result (b + 2d, 0, 2b + d, 0) of the fourth PSHUFB instruction is stored in the second register. Stored in

  In block 408, the result stored in the first register (block 402) and the result stored in the second register (block 406) are both mixed column conversion results (b + 2d, a + 2c, 2b + d, 2a + c). XORed to provide. In the exemplary embodiment, this result is XORed using the PXOR instruction. The PXOR instruction performs an XOR operation on the contents of two registers and stores the result in one of the registers.

  In block 410, a packed shuffle byte (PSHUFB) instruction is used to shuffle the bytes of input data (d, c, b, a) based on the mask.

  Referring to FIG. 5C, 506 shows the initial contents of the third register, and 508 shows the contents of the third register after the PSHUFB instruction is executed with the shuffle control mask of “000302h”. As shown, the bytes of input data (d, c, b, a) are shuffled to provide the result (b, a, d, c) 510 stored in the third register.

  Continuing with FIG. 4, in block 412, register 3 (b + 2d, b + 3d, 2b + d, 3b + d) and register 2 (b, a, d) are provided to provide the result of the multiplication, ie, (2d, 2c, 2b, 2a). , C), an XOR operation is performed.

  An embodiment has been described in which multiplication by g = {02} is performed on a 4-byte data block. Table 4 below shows a functional accurate optimized code sample (assembler) executed on one 16-byte data block.

テーブル４のコードサンプルに示されるように、ガロア体乗算は、１１個の命令（５つのＰＳＨＵＦＢ命令、２つのＰＸＯＲ命令、２つのＡＥＳＥＮＣ命令、２つのＡＥＳＤＥＣＬＡＳＴ命令）、３個のマスク（マスク１，マスク２，マスク３）及び３個のｘｍｍレジスタ（ｘｍｍ１，ｘｍｍ２，ｘｍｍ３）を用いて、１６バイトのデータに対して実行される。

As shown in the code sample in Table 4, Galois field multiplication involves 11 instructions (5 PSHUFB instructions, 2 PXOR instructions, 2 AESENC instructions, 2 AESDECLAST instructions), 3 masks (Mask 1, This is performed on 16 bytes of data using mask 2, mask 3) and three xmm registers (xmm1, xmm2, xmm3).

  For example, the execution result of Galois field multiplication for the input data “e598271ef11141b8ae52b4e0305dbfd4” yields the output “d12b4e3cf922826b47a473db60ba65b3”.

  In this code sample, if the instructions are processed sequentially, the throughput is slowed by the delay of the AES instruction. For example, in the embodiment, the delay of the PSHUFB and PXOR instructions is 1 cycle, and the delay of the AES instruction is 6 cycles. Thus, when AES instruction pairs are processed sequentially, a 12 cycle delay occurs. In another embodiment, the overall delay is a plurality of 16 bytes of input data from the interleaved instruction so that the second AES instruction of the pair of AES instructions is scheduled 6 cycles after the first AES instruction is scheduled. May be reduced by processing them simultaneously. The order of the sample code instructions shown in Table 4 may be changed as shown in the examples shown in FIGS. This instruction order allows multiple 16-byte data blocks to be processed simultaneously. This is because the delay of the AES instruction is greater than the delay of the PXOR and PSHUFB instructions.

  6A-6C are sample code that allows Galois field multiplication to be performed simultaneously on multiple 16-byte data blocks. This code is just one example of a code that can be used. There may be many other variations, for example, the code may be optimized for use by a particular compiler. 6A to 6C show a function (inline assembler) for performing multiplication by {02} on a data buffer of an NBLOCKS data block (each block has 16 bytes (16B)). Since four 16-byte blocks are processed in parallel and a 256-byte data buffer is used, the processing (four parallel 16-byte blocks) is repeated four times (four blocks in parallel). Twelve xmm registers (xmm0 to xmm11) are used to store input data and its operation results. Three mask registers (mask 1, mask 2, mask 3) store the same mask as the sample code shown in Table 4. Referring to FIG. 6A, the instruction in block 600 sets the even byte position of the input data stored in the xmm registers (xmm1, xmm4, xmm7, xmm10) to zero. In the illustrated example, a packed shuffle byte (VPSHUFB) instruction is used to set the odd byte position to zero. The VPSHUFB instruction executes PSHUFB after move and the contents of xmm0 are moved to xmm1 and the contents of xmm1 are stored in the control mask stored in xmm0 with respect to the instruction “vpshub xmm1, xmm0, mask1”. Shuffle based.

  Next, the AESDECLAST instruction in block 602 is executed on the input data having odd byte positions set to zero stored in the xmm1, xmm4, xmm7 and xmm10 registers.

  The instruction in block 604 moves the input data to the xmm registers (xmm2, xmm5), sets the odd byte positions to zero, and shuffles the input bytes in the xmm registers (xmm0, xmm3) as described with respect to FIG. 5C. To do.

  Referring to FIG. 6B, the AESENC instruction in block 606 isolates the mix column conversion and stores the result in the xmm registers (xmm1, xmm3, xmm7, xmm10).

  The instruction in block 608 moves the input data to the xmm registers (xmm8, xmm11), sets the even byte position to zero, and resets the input bytes in the xmm registers (xmm6, xmm9) as described with respect to FIG. 5C. Shuffle.

  The instruction in block 610 executes the AESDECLAST instruction on input data having an even byte position set to zero stored in the xmm registers (xmm2, xmm5, xmm8, xmm11).

  The instruction in block 612 zeroes out the odd position bytes of the data stored in the xmm registers (xmm1, xmm4, xmm7, xmm10).

  The instruction in block 614 executes an AESENC instruction on the data stored in the xmm registers (xmm2, xmm5, xmm8, xmm11), and in the result stored in the xmm registers (xmm2, xmm5, xmm8, xmm11) Set even byte position to zero.

  The instruction in block 616 performs an XOR operation on the contents of the xmm registers (xmm0 to xmm11) to provide the result of the multiplication in the xmm registers (xmm0, xmm3, xmm6, xmm9).

  The instruction in block 618 moves the result of the multiplication stored in the xmm register (xmm0, xmm3, xmm6, xmm9) to the rbx register.

  The instruction in block 620 calculates a pointer to the location of the next 16 byte block to be multiplied.

In another embodiment, if the RAID-6 calculation is performed with other representations of GF (2 ⁸ ), by converting the input to a “preferred” representation (with the reduction polynomial 11B) to which the AES instruction can be applied. It is possible to use the technique described above. A final conversion to the original representation is required (however, it can be reserved in cases where recovery is actually required). This conversion can be performed using a pre-calculated table.

  Other embodiments of the present invention also include a machine accessible medium containing instructions for performing the processing of the present invention. Such an embodiment may also be referred to as a program product. Such machine-accessible media include, but are not limited to, floppy (registered trademark) disks, hard disks, CD-ROM (Compact Disk-Read Only Memory), ROM (Read Only Memory), RAM (Random Access Memory), and the like. Storage media and other tangible configurations of particles formed or manufactured by a machine or device. The instructions may also be utilized in a distributed environment and stored locally and / or remotely for access by a single or multiprocessor machine.

  While embodiments of the invention have been illustrated and described with reference to such embodiments, those skilled in the art will recognize the form and details without departing from the scope of the embodiments of the invention encompassed by the appended claims. It will be understood that various changes are possible.

Claims (20)

Performing a Galois field multiplication operation on each of a plurality of bytes of a block of bytes, comprising:
Performing the Galois field multiplication operation,
Performing an Advanced Encryption Standard (AES) mix column transformation on the block of bytes in which all even position bytes are set to zero to provide a first result;
Performing the AES mix column conversion on the block of bytes in which all odd position bytes are set to zero to provide a second result;
Combining the first result and the second result to provide a result of the Galois field multiplication operation;
Having a method.   The method according to claim 1, wherein the finite field in the Galois field multiplication operation is defined by a reduction polynomial 0x11B.   The method of claim 1, wherein performing the AES mix column transformation comprises performing an AESDECLAST round instruction followed by an AESENC round instruction. The conversion sequence executed by the AESDECLAST round instruction includes an Inverse Shift Rows conversion and an Inverse Substitute Bytes conversion.
The method according to claim 3, wherein the conversion sequence executed by the AESENC round instruction includes a Shift Rows conversion, a Substitute Bytes conversion, and a mix column conversion. Performing an exclusive OR (XOR) operation on the first result and the second result to provide a third result;
Shuffling the data stored in the block of bytes to switch the lower 2 bytes and the upper 2 bytes of each 4-byte block in the block of bytes to provide a fourth result;
Performing an XOR operation on the third result and the fourth result;
The method of claim 1, further comprising:   The method according to claim 1, wherein the AES mix column conversion converts a 4-byte block sequence d, c, b, a into another 4-byte block sequence 3a + b + c + 2d, a + b + 2c + 3d, a + 2b + 3c + d, 2a + 3b + c + d.   The method of claim 1, wherein the synthesis is utilized to calculate a Q syndrome for a level 6 RAID system. A memory for storing a plurality of instructions for executing a Galois field multiplication operation in parallel for each of a plurality of bytes of a block of bytes;
A processor including an execution unit;
A device comprising:
When the instruction is executed by the execution unit, the execution unit provides a first result so that the AES (Advanced Encryption Standard for all blocks of bytes with all even position bytes set to zero. ) Performing the AES mix column transform on the block of bytes where all odd position bytes are set to zero to perform a mix column transform and provide a second result, the Galois field multiplication operation An apparatus that is stored in the memory in order of combining the first result and the second result to provide a result.   The apparatus according to claim 8, wherein the finite field in the Galois field multiplication operation is defined by a reduction polynomial 0x11B.   9. The apparatus of claim 8, wherein the execution unit performs the AES mix column transformation by executing an AESDECLAST round instruction followed by an AESENC round instruction. The conversion sequence executed by the AESDECLAST round instruction includes an Inverse Shift Rows conversion and an Inverse Substitute Bytes conversion.
The apparatus according to claim 10, wherein the conversion sequence executed by the AESENC round instruction includes a Shift Rows conversion, a Substitute Bytes conversion, and a mix column conversion.   9. The apparatus according to claim 8, wherein the AES mix column conversion converts a 4-byte block sequence d, c, b, a to another 4-byte block sequence 3a + b + c + 2d, a + b + 2c + 3d, a + 2b + 3c + d, 2a + 3b + c + d.   9. The apparatus of claim 8, wherein the composition is utilized to calculate a Q syndrome for a level 6 RAID system. A machine-accessible storage medium having relevant information,
The information, when accessed, causes the machine to perform a Galois field multiplication operation on each of the plurality of bytes of the block of bytes,
The execution of the Galois field multiplication operation is as follows:
Performing an Advanced Encryption Standard (AES) mix column transformation on the block of bytes in which all even position bytes are set to zero to provide a first result;
Performing the AES mix column conversion on the block of bytes in which all odd position bytes are set to zero to provide a second result;
Combining the first result and the second result to provide a result of the Galois field multiplication operation;
A storage medium . The storage medium according to claim 14, wherein the finite field in the Galois field multiplication operation is defined by a reduction polynomial 0x11B. The storage medium of claim 14, wherein performing the AES mix column conversion includes executing an AESDECLAST round instruction followed by an AESENC round instruction. The conversion sequence executed by the AESDECLAST round instruction includes an Inverse Shift Rows conversion and an Inverse Substitute Bytes conversion.
The storage medium according to claim 14, wherein the conversion sequence executed by the AESENC round instruction includes a Shift Rows conversion, a Substitute Bytes conversion, and a mix column conversion. A processor;
A storage device accessible by the processor and storing a plurality of instructions;
A system comprising:
At least one of the instructions performs a conversion sequence and, when executed by the processor, provides a first result to the processor to block the bytes with all even position bytes set to zero. To perform an AES (Advanced Encryption Standard) mix column conversion and provide the second result, the AES mix column conversion is performed on the block of bytes where all odd position bytes are set to zero. And a system configured by combining the first result and the second result to provide a result of the Galois field multiplication operation.   The system according to claim 18, wherein the finite field in the Galois field multiplication operation is defined by a reduction polynomial 0x11B.   19. The system of claim 18, wherein an AESDECLAST round instruction followed by an AESENC round instruction performs the AES mix column conversion.

Images